topic Re: XSOAR HTTPS certificate issues in Cortex XSOAR Discussions

XSOAR HTTPS certificate issues

laurence64 — Tue, 05 Jan 2021 20:45:24 GMT

Hi All,

I have an issue where I have replaced the self-signed auto generated certificate in XSOAR, the problem is that when I reboot the server the web service doesn't seem to come up, there is no service listening on port 443.

Any help would be greatly appreciated.

Re: XSOAR HTTPS certificate issues

OriNahir — Tue, 05 Jan 2021 21:23:30 GMT

Is the service not starting?

You might want to check the logs under /var/log/demisto/server.log and check the errors there, to better understand what prevents the service from starting

Ori

Re: XSOAR HTTPS certificate issues

laurence64 — Tue, 05 Jan 2021 21:41:53 GMT

Thank you for the reply, I have checked there and can't find any reference to the http server, I will have a more through look and post what I see, but yes it does seem that the change in certificate is stopping the service from starting.

Re: XSOAR HTTPS certificate issues

OriNahir — Tue, 05 Jan 2021 21:48:57 GMT

This article describes how to use a signed certificate for the HttpS communication with the XSOAR console
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/installation/post-installation-checklist/https-with-a-signed-certificate

Please note that XSOAR web server is part other XSOAR service.

Re: XSOAR HTTPS certificate issues

laurence64 — Thu, 14 Jan 2021 18:01:06 GMT

Apologies for the massive delay in getting back to you, I did follow the guide in the link and still it was overwriting the certificates on reboot, I still haven't found a way to make it work.

Re: XSOAR HTTPS certificate issues

OriNahir — Wed, 20 Jan 2021 22:26:20 GMT

Did you check the server logs under `/var/log/demisto/server.log` right after the server restarts?

DId you find any errors or mention to the certificate there?

Re: XSOAR HTTPS certificate issues

laurence64 — Thu, 04 Feb 2021 22:48:35 GMT

Please accept my apologies for the delay in getting back to you, I appreciate the help just been really busy, there is no mention of anything that looks like the webserver in the logs, I have a lot of telemetry errors but that is just about it.

I will generate the cert again and have a look right after as opposed to retrospectively and post the results.